ConnectWise Backup Credential Breach Exposes Microsoft 365 Tenants
Attackers used a stolen vendor API secret to access 173 Microsoft 365 environments, bypassing user authentication through a trusted backup application.
Key points
- Huntress confirmed unauthorized sign-ins in 173 partner and customer tenants using a compromised ConnectWise Cloud Backup credential.
- The attacker obtained Microsoft Graph tokens on October 15, 2026, allowing access to mailboxes, files, and directory data without user passwords.
- In one instance, a related app assigned itself Global Administrator privileges and added new secrets to other trusted applications.
Threat actors gained unauthorized access to 173 Microsoft 365 tenants by exploiting a compromised API secret belonging to ConnectWise Cloud Backup. This credential allowed attackers to authenticate as the trusted backup application, bypassing standard user authentication controls. According to Huntress, the stolen secret provided access to Exchange mailboxes, OneDrive, SharePoint, Teams, and directory information across affected environments. The incident highlights the risk of privileged vendor applications when their secrets are exposed.
How it unfolded
- On October 13 and 14, 2026, the same IP address attempted password spraying against four law firm tenants, though Huntress detected no successful user sign-ins.
- On October 15, 2026, between 06:13 and 08:34 UTC, the attacker used the compromised ConnectWise credential to obtain Microsoft Graph tokens from IP address 144.172.64[.]128.
- The actor cycled through tenant identifiers in sorted order with seconds between attempts, indicating an automated script processing a prepared target list.
- In at least one partner tenant, a secondary ConnectWise app assigned itself Global Administrator privileges and added new client secrets to other trusted applications.
Who is affected
Every organization that has ConnectWise Cloud Backup installed is potentially impacted, as the compromised credential works against every tenant where the app is consented. Huntress observed confirmed unauthorized sign-ins within 173 partner and customer tenants. Microsoft Threat Intelligence confirmed it is tracking this active supply chain attack. The breach affects managed service providers and their clients who rely on the platform for backup and recovery of Microsoft 365 or Google Workspace data.
View the original post on X
The fix
ConnectWise has shut down customer access to its Cloud Backup service, interrupting backup operations. No software patch or update has been confirmed yet to remediate the compromised credential. Defenders must review all app secrets and certificates, not only the ConnectWise entries, because disabling the original apps does not remove credentials already planted in other app registrations. The added secrets were set to expire in 2028, creating long-term exposure.
What made it possible
This incident demonstrates the danger of over-privileged vendor applications in multitenant environments. When a backup service requires broad access to mailboxes and directory data, a single compromised API secret grants attackers immediate entry to every customer environment. Teams usually rely on app-only identities for automation, which bypasses user-level multi-factor authentication. Check whether your organization has granted excessive permissions to third-party tools and ensure vendor secrets are rotated regularly to limit blast radius.
What to do and how to stay safe
- Audit all third-party application registrations in your Microsoft 365 tenant and revoke access for any unused or untrusted apps.
- Review client secrets and certificates for all registered applications, not just the affected vendor, to remove any unauthorized credentials.
- Monitor sign-in logs for unusual activity from known vendor IP addresses or unexpected token acquisition patterns.
- Verify that backup applications operate with the minimum permissions necessary for their function rather than broad administrative rights.
Step-by-step guide: DDoS Attack Mechanics: Answers to 10 Critical Questions
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the attacker use user passwords to gain access?
No, the attacker used a compromised API secret from the vendor’s home tenant, allowing app-only identity access without user passwords or MFA.
How many tenants were affected by this breach?
Huntress confirmed unauthorized sign-ins in 173 partner and customer tenants as of the latest reporting.
Is there a patch available for this vulnerability?
No fix has been confirmed yet; Connect
